Administration
Connect an authorized wallet to see the Admin page and the operations assigned to it. Contracts enforce every transaction's permissions.
Roles and permissions
Admin navigation and forms stay hidden until a connected wallet on the configured chain matches an onchain owner or settlement-operator role. Each action appears only for its assigned role. A failed permission read keeps controls hidden. Disconnecting or changing account or network clears access immediately.
Factory ownership does not update existing market ownership. The server's price signer is not an admin role. Public contract roles and bytecode are not confidential; the wallet must sign and the contract must authorize any transaction, regardless of interface visibility.
New vaults use independently upgradeable proxies. Each market owner can replace that vault's implementation while keeping its address and stored balances. Upgrades are contract-level operations and are not exposed in the Admin page. Existing non-proxy vaults require a separate migration.
| Role | Authority |
|---|---|
| Factory owner | Creates ticker markets. A new market initially receives the factory's current owner. |
| Market owner | Authorizes proxy upgrades. Cancels and changes the settlement operator during Funding. |
| Settlement operator | Delivers the selected payout token and settles the market. |
| Oracle owner | Rotates the authorized price signer. Rotation changes the signer epoch. |
| Authorized signer | Signs price checks accepted by the oracle. |
| Any wallet | Can publish a valid signed quote. Can buy while funding and claim its own pre-tokenized stocks when distribution opens. |
Create a ticker vault
Connect the factory-owner wallet and enter the company name, ticker, settlement operator and maximum oracle age. The app normalizes the ticker to uppercase and hashes it for the market identifier. The factory rejects a duplicate identifier.
The new market uses the factory's configured USDG and oracle. Its maximum oracle age is fixed at creation; the signed oracle's own expiry checks still apply. For this oracle, the vault age check uses the signed market-check time, while the oracle separately enforces source-price policy.
Creating a contract does not automatically add its instrument to the server feed or the frontend catalog. Supporting a new ticker also requires its exact price-source mapping, catalog update and deployment. Without a valid signed price, it cannot accept purchases.
Publish a signed price
Select the ticker and review Source time, Market, Checked and Valid until. Publish signed price submits the existing authorized signature. No owner role is required to relay it, but the publishing wallet pays gas.
The Admin page is visible only to authorized wallets. Public buyers can still relay a valid signed quote through the purchase flow; hiding the admin interface does not change the oracle's permissionless publication rule.
The current page has no manual-price field and does not allow arbitrary price overrides. Signer rotation and operator changes are contract-level owner operations, not controls exposed by this page.
Settle or cancel
To settle, connect the designated operator wallet. Verify the intended stock-token contract and acquisition terms outside the app. Enter the payout-token address, amount and USDG recipient, select Review settlement, then confirm approval and settlement. The operator must already hold the deliverable tokens.
Before approval, the app checks the current operator, funding phase, pre-tokenized stock supply, token amount and balance. It requests allowance only when needed. Before settlement it rechecks the wallet and role and simulates the call. If the account or network changes, the workflow stops. Any earlier approval remains and can be revoked in the wallet.
Settlement releases the full vault USDG balance, even though the entered payout amount is chosen by the operator. The contract checks delivery, not fair value or issuer backing. Review the amount, asset and recipient before the irreversible transaction.
To cancel, connect the market owner, select Start refund mode, then Confirm refund mode. The first click does not transact. The confirmation starts the permanent Refunding phase if the contract conditions are met.